sbom-unifier: Integration Framework for Heterogeneous SBOMs

2026-08-31

AI Summary

sbom-unifier通过集成和补充多种工具输出及文件级丰富，解决了SBOM生成工具输出异构、字段覆盖不全的问题，提高了SBOM的完整性。

Abstract

A Software Bill of Materials (SBOM) is a machine-readable inventory of software components, increasingly required for vulnerability management and license compliance. However, existing SBOM generation tools often leave many SPDX-defined fields missing or only partially populated, because different tools produce heterogeneous outputs with uneven field-level coverage. We present sbom-unifier, a framework that improves SBOM completeness through field-level integration and complementation of multiple tool outputs and file-level enrichment. Unlike existing tools that simply concatenate SBOMs without identifying records referring to the same component, sbom-unifier identifies components via Package URL (PURL), complements missing field values by a deterministic priority-based strategy, reconstructs cross-section references, and further enriches file-level fields. Across 90 open-source projects in 9 programming languages, sbom-unifier preserves high completeness for required fields and, over the 39 SPDX 2.3 required and optional fields, raises the fully covered rate by 8 percentage points and reduces the totally missing rate by 11 percentage points over the respective best-performing individual tools. sbom-unifier is available at https://github.com/MoriwakiYusuke/sbom-unifier.

Problem

• SBOM
• heterogeneous outputs
• field-level coverage
• vulnerability management
• license compliance

Innovation

• field-level integration
• Package URL (PURL)
• deterministic priority-based strategy
• cross-section references